Contents

Claws Mail && S/MIME plugin howto

Recently there were many requests on the mailing list on how to configure the S/MIME plugin to work properly. It is not a trivial task as the GUI doesn't provide any configuration options and everything needs to be done in the console.

I've had a "half-working" setup but always failed on some point when importing S/MIME certificates. I now managed to have a working config and hopefully this howto will give an insight on how to achieve it.

This howto is based on Gentoo but should be working fine on every other distribution if adjusting it accordingly :)

Importing S/MIME certificates into gpgsm

First one has to obtain the Thawte Freemail certificate and install it into Firefox/Thunderbird. Export the certificate from Firefox/Thunderbird e.g. to "certbundle.p12" file and remember the passphrase.

Configuring S/MIME

You need to create the file (if it doesn't exist) "$HOME/.gnupg/trustlist.txt" to add Thawte to the trusted key list. This makes it possible to verify/sign/.../ with your Thawte certificate. Add the following lines which contain the fingerprint (not serial number!) of the key and the letter S at the end:

gpg-agent is only necessary for caching the passphrase: "$HOME/.gnupg/gpg-agent.conf"

pinentry-program /usr/bin/pinentry-qt
default-cache-ttl 86400 # be aware that the passphrases will be cached for 86400 seconds! set accordingly to your need
max-cache-ttl 86400
disable-scdaemon
allow-mark-trusted

Working with S/MIME plugin and problems/bugs

I think because few people managed to get it to work properly there weren't many bug reports yet :) There are some things I encountered which don't work fine, e.g. keep in mind:

from the README:
WARNING: This plugin doesn't handle sign+encrypt and encryption of multipart messages very well (yet).

That means if you encrypt and sign a message you get some header stuff in the body of the message and it will be a lot more garbage if you have attached files. Encrypting alone (without attachments) or signing alone (with or without attachments) works fine.

I always have to choose my key twice in the "Select Keys" dialog when encrypting? It seems the "Trust key" dialog doesn't show the name of the key, e.g. "The key of is not fully trusted". CM first asks for the key of the recipient and then asks for the sender's key because CM can't extract it properly: "No exact match for 'email@address'; please select the key." (guess that is because I have two certs..). If I send an email to a friend and include myself (To:), CM will ask me three times for the correct keys.

Although I added my own fingerprint to trustlist.txt CM always says that the recipient is not fully trusted when I send encrypted/signed emails.

As of now the "Select Keys" dialog when encrypting emails is a bit awkward to use if you have more than one key (e.g. one expired one you still want to keep to be able to decrypt older emails). It only shows the Key ID and no info about the date which makes it more difficult to choose the correct one.